#include <windows.h>
#include <TLHELP32.H>

struct _ProcessMsg
{
	int (WINAPI *MyMessageBox)(HWND, LPCTSTR, LPCTSTR, UINT);
};

DWORD WINAPI ThreadProc(LPVOID lpParent)
{
	struct _ProcessMsg *msg = (struct _ProcessMsg*)lpParent;
	
	msg->MyMessageBox(NULL, TEXT("我是无dll进去的"), TEXT("提示"), MB_OK);
	
	return 0;
}

DWORD GetProcessID(TCHAR *szProcess)
{
	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
	PROCESSENTRY32W pe;
	
	if (hSnapshot == INVALID_HANDLE_VALUE) return -1;
	pe.dwSize = sizeof(pe);
	Process32FirstW(hSnapshot, &pe);

	do 
	{
		if (0 == wcsicmp(szProcess, pe.szExeFile))
		{
			return pe.th32ProcessID;
		}
	} while(Process32NextW(hSnapshot, &pe));
	
	return 0;
}

HANDLE GetProcessHandle(TCHAR *szProcess)
{
	DWORD dwProcess = GetProcessID(szProcess);
	//找到进程则不为0
	if (0 == dwProcess)
	{
		MessageBoxW(NULL, TEXT("找不到进程"), TEXT("提示"), 0);
		return NULL;
	}
	//打开进程
	HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_QUERY_INFORMATION|
		PROCESS_VM_OPERATION|PROCESS_VM_WRITE, FALSE, dwProcess);
	
	return hProcess;
}

bool InserThread(HANDLE hProcess)
{
	struct _ProcessMsg msg;
	(FARPROC&)msg.MyMessageBox = GetProcAddress(GetModuleHandleW(TEXT("User32.dll")), "MessageBoxW");
	DWORD dwSize = sizeof(msg);
	
	//向远程进程中写入参数
	LPVOID lpBuf = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
	DWORD dwWrite;
	if (0 == WriteProcessMemory(hProcess, lpBuf, &msg, dwSize, &dwWrite))
	{
		VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT);
		MessageBoxW(NULL, TEXT("写入远程数据错误"), TEXT("提示"), 0);
		return FALSE;
	}
	
	LPVOID lpThread = VirtualAllocEx(hProcess, NULL, 1024, MEM_COMMIT, PAGE_READWRITE);
	if (0 == WriteProcessMemory(hProcess, lpThread, ThreadProc, 1024, &dwWrite))
	{
		VirtualFreeEx(hProcess, lpThread, 1024, MEM_DECOMMIT);
		MessageBoxW(NULL, TEXT("写入远程数据错误"), TEXT("提示"), 0);
		return FALSE;
	}
	
	CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpThread, lpBuf, 0, 0);
	return true;
}

int main()
{
	TCHAR szProcess[64] = TEXT("explorer.exe");
	HANDLE hProcess = GetProcessHandle(szProcess);		//获取指定进程句柄
	
	if (NULL == hProcess)
	{
		MessageBoxW(NULL, TEXT("打开进程失败"), TEXT("警告"), 0);
		return -1;
	}
	
	bool blInsert = InserThread(hProcess);			//向指定进程远程写入线程并执行
	
	if (FALSE == blInsert)
	{
		MessageBoxW(NULL, TEXT("插入远程线程失败"), TEXT("警告"), 0);
		return -1;
	}
	return 0;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！